CVE-2023-53474

Severity CVSS v4.0:
Pending analysis
Type:
CWE-190 Integer Overflow or Wraparound
Publication date:
01/10/2025
Last modified:
20/01/2026

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86/MCE/AMD: Use an u64 for bank_map<br /> <br /> Thee maximum number of MCA banks is 64 (MAX_NR_BANKS), see<br /> <br /> a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64").<br /> <br /> However, the bank_map which contains a bitfield of which banks to<br /> initialize is of type unsigned int and that overflows when those bit<br /> numbers are &gt;= 32, leading to UBSAN complaining correctly:<br /> <br /> UBSAN: shift-out-of-bounds in arch/x86/kernel/cpu/mce/amd.c:1365:38<br /> shift exponent 32 is too large for 32-bit type &amp;#39;int&amp;#39;<br /> <br /> Change the bank_map to a u64 and use the proper BIT_ULL() macro when<br /> modifying bits in there.<br /> <br /> [ bp: Rewrite commit message. ]

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.10 (including) 5.10.180 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.111 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.28 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.2.15 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.3 (including) 6.3.2 (excluding)